Building a CLI with go-tool-base, part 3: expose your CLI to AI agents
Expose an existing Go CLI to AI agents over MCP without writing any AI code, using built-in commands. The agent reach equals the CLI reach.
Tags
77 pages
Go
Building a CLI with go-tool-base, part 2: configuration your tool can trust
Configuration for a Go CLI: precedence of flags over env over files, per-command embedded defaults, layered config merging and a strict mode.
Building a CLI with go-tool-base, part 1: scaffold and your first command
Install gtb, scaffold a releasable Go project, understand the generated and owned file split, then add your first command and run it.
Reloading config without a restart
Hot-reloading configuration: watch the file, re-read it, swap it in atomically and notify observers, without restarting a long-running service.
Verifying your own downloads: how I solved it for self-updating CLI tools
Self-update integrity for a CLI: verify the downloaded binary against the release checksums file, and decide whether to fail open or closed.
What survives a port, and what doesn't
Porting a Go framework to Rust separates design from idiom. Which decisions survived the move, which were habits, and how to tell them apart.
rust-tool-base: the same idea, in a language that argues back
A sibling to go-tool-base rather than a port, filling the gap between excellent Rust crates and a coherent way to assemble them.
The blank import that keeps a dependency out of your binary
Making OS-keychain support provably absent from a Go binary for regulated or air-gapped builds, using a registry and a blank import.
Where should a CLI keep your API keys?
Credential storage for a Go CLI: an env-var reference by default, an opt-in OS keychain, and plaintext only as a last resort and banned in CI.
A configurable AI endpoint is an attack surface
A user-settable AI base URL decides where your API key gets sent. Validating it to reject userinfo, non-HTTPS schemes and redirects.
